1. Regulatory Frame — Why Banks in Spain Must Care Now

eIDAS 2.0 — Regulation EU 2024/1183 — Entered into force 20 May 2024
All EU Member States must provide residents a national digital identity and at least one EUDI Wallet app by December 2026. EEA gets +1 year. Council passed legal agreement March 2024.

The Tipping Point for Banking — Article 5f (5 septies):
Specific private providers excluding micro and small enterprises will be obliged to accept EUDI Wallet. This applies to strategic sectors such as banking, energy, telecom, insurance, transport, health, education, whenever legal or contractual obligation for Strong Customer Authentication (SCA) exists.

In Spain: FNMT is leading development of wallet. Deadline: Banks legally required to accept EUDI Wallet by 2027 for any process requiring SCA — onboarding, login, payment authorization. 24 of 27 member states expected to miss Dec 24 2026 deadline, but obligation remains.

Banco de España + SEPBLAC KYC Rules 2026:
In Spain KYC in 2026 is all about file quality — firms need to show exactly how they identified customer, checked beneficial ownership, handled remote onboarding, and verified crypto counterparties under post-MiCA rules. Objective is not isolated checks but continuous compliance system. Digital identity verification must be audit-ready, report suspicious operations to SEPBLAC. Royal Decree-Law 19/2018 transposes PSD2, Banco de España oversees authorization and SCA.

2. Three Governance Models Deployed in Spain

Model A: Consortium / Public-Permissioned Blockchain — Alastria Model — Most Used in Banking

Ten Spanish companies partnered: Banco Santander, Bankia, BME, CaixaBank, Inetum, Liberbank, Linea Directa, Mapfre, Naturgy, Repsol + Alastria consortium to develop self-managed digital identity model with blockchain.

Architecture:

• Alastria is multi-sector Spanish consortium of 600 partners, mission to provide basic Blockchain Infrastructure "Red Alastria" and Digital Identity standard "ID Alastria" that allows transactions using smart contracts with full legal guarantees in Spain.
• Uses Ethereum and Quorum blockchain infrastructure to handle transfer of user IDs, in accordance with Spanish and EU regulations, GDPR.
• Semi-public blockchain — each member's digital identity is certified and guaranteed.
• Alastria ID — decentralized identity solution compatible with EEA Enterprise Ethereum spec, adopted by several businesses, implements W3C DID standard.
• Governance: Non-profit association, board with banks + telcos + energy. Nodes run by members. Legal wrapper: Spanish association, GDPR-compliant via off-chain storage + hash on-chain.

Banking Use: BBVA in Spain uses electronic identity verification to onboard customers instantly. Integrating EUDI Wallet credentials would allow secure cross-border banking access under eIDAS 2.0. KYC reuse — customer onboarded at CaixaBank can reuse verifiable credential at Santander without new video KYC — consent-driven selective disclosure.

Model B: Self-Sovereign Identity (SSI) — User-Centric — eIDAS 2.0 Vision

Technical sovereignty model — Spain's Digital ID or eIDAS 2 moves towards decentralized, user-centric models, enabling selective disclosure where users can prove specific attributes (e.g. legal age) without revealing full identity.

Standards:

• W3C Decentralized Identifiers (DIDs) — avoid centralized identity anchors
• Verifiable Credentials (VCs) — mutual recognition across borders — digital diploma from Belgium instantly verifiable in Spain.
• User holds wallet on phone, bank is verifier, not custodian.

Governance: Decentralized — FNMT as Trust Service Provider issues qualified attestations, but user controls private key. GDPR Article 5f data minimization satisfied — prove "over 18" without sharing birthdate.

Model C: Federated + Qualified Trust Service Provider (QTSP) — Current Cl@ve System Evolving

Spain emphasizes mobile identity and private QTSPs via Cl@ve, while France relies heavily on private QTSPs. Cl@ve is federated gateway — public administrations + banks via private QTSPs like FNMT, Camerfirma.

Under eIDAS 2.0, Cl@ve evolves into EUDI Wallet gateway — FNMT issues PID (Person Identification Data) as qualified.

3. Banking Compliance Implications

4. Case Laws / Enforcement Analogies

No direct DID banking case law yet — but Spanish courts already ruled on similar digital identity abuses that DID fixes:

1. Floor Clause Analogy — STS 9 May 2013 + CJEU 21 Dec 2016:
Supreme Court ruled floor clauses abusive due to lack of transparency — consumers not informed about economic burden. Same test will apply to DID consent screens — if wallet asks blanket consent to share full DNI when only age needed, clause abusive under Directive 93/13.

2. Bankia IPO / Preferentes Cases — STS 2016:
Bank sold complex products without proper client suitability test (KYC). DID governance requires verifiable credential of financial knowledge — prevents mis-selling.

3. AEPD Fines on Banks for Inadequate Identity Verification — 2023-24:
Spanish DPA fined ENDESA €6.1M for lack of security measures resulting in vulnerability of data. Same principle — CaixaBank fined €6.2M 2024 for inadequate security measures. DID reduces central honeypot.

4. EU Case — Definitive ID / Wise Security — Alastria 2022:
Definitive ID is blockchain-based SSI solution implementing W3C DID on Alastria Network. Enables users to create/manage decentralized identities while maintaining sovereign control. No court yet but audited as GDPR-compliant by AEPD sandbox.

5. Future Litigation Risk — EUDI Wallet Mandatory Acceptance:
If bank refuses EUDI Wallet for SCA in 2027, client can sue under eIDAS 2 Art 5f — Spanish courts will apply direct effect of Regulation. Veridas notes Spain FNMT leading — non-acceptance = administrative sanction by Banco de España + SEPBLAC.

5. Implementation Roadmap for Spanish Bank

1. Join Alastria + EWC Pilot: Become Alastria ID issuer/verifier. Already 10 banks in.
2. Integrate FNMT EUDI Wallet Sandbox: Test PID and qualified attribute attestation — e.g., IBAN ownership credential.
3. Update KYC Policy Document: Define which verifiable credentials you accept as equivalent to video KYC — e.g., FNMT qualified PID + SEPBLAC-approved liveness VC.
4. Audit Trail: Store DID resolution + VC verification proof, not raw DNI image — satisfies Banco de España file quality 2026.
5. Consent Management: Build selective disclosure UI — user chooses what to share.